Privacy Policy

Who we are (data controller)

wordbound is operated by Flagrare Tech Sistemas LTDA. (trading as Flagrare Tech), a company registered in Brazil under CNPJ 44.372.897/0001-50, based in Belo Horizonte, Minas Gerais, Brazil. For the purposes of the Lei Geral de Proteção de Dados (LGPD) and the EU/UK General Data Protection Regulation (GDPR), this company is the data controller responsible for your personal data.

For any privacy or data-protection request — or to request our full postal address — contact our data-protection point of contact at privacy@wordbound.app.

Information we collect

• Account information: When you sign in with Google, GitHub, LinkedIn, Microsoft, or email/password, we collect your name, email address, and profile picture (if provided by the sign-in provider). We never receive or store your provider passwords.
• Profile data: Username, display name, bio, job titles, portfolio works, social links, and any other information you choose to add to your wordbound profile.
• Content: Written works, portfolios, descriptions, and any files you upload to showcase your narrative craft.
• Usage & analytics data: Pages visited and in-product actions, plus device and browser type. By default this is collected anonymously and without cookies (see "Analytics & your consent" below).
• Consent records: When you make a cookie/analytics choice, we store an audit record of that decision and the policy version you agreed to, so we can honour and prove it.
• Essential cookies: Authentication tokens stored in secure, httpOnly cookies to keep you signed in, and a small cookie that remembers your consent choice. These are strictly necessary and set no tracking.

How we use your data

• Authenticate you and maintain secure sessions.
• Display your portfolio and works to visitors and potential collaborators.
• Provide core features like work uploads, profile customization, and portfolio sharing.
• Send verification and account emails.
• Understand which features are used (with your consent) to improve the platform.
• Communicate important service updates or security notices.

We do not sell your data, use it for third-party advertising, or train AI models on your content.

Analytics & your consent

We use PostHog for product analytics to understand how wordbound is used and where to improve it. Our default is privacy-first:

• Anonymous and cookieless by default. Until you explicitly accept, analytics runs without cookies or persistent identifiers — visits are counted anonymously and cannot be tied back to you across sessions.
• Consent upgrades it, nothing else. Only if you choose "Accept" in our cookie banner do we enable a persistent analytics cookie for sharper, cross-visit measurement.
• You can change your mind anytime. Use the "Cookie settings" link in the site footer to withdraw or grant consent at any point. Withdrawal takes effect immediately.

Who we share data with (processors)

We use a small number of trusted service providers ("operators" under the LGPD, "processors" under the GDPR). Each only accesses the data needed for its function, and only on our instructions:

• Google, GitHub, LinkedIn, Microsoft — sign-in (OAuth). They confirm your identity and share your name, email, and avatar with us; we never see your password.
• Resend — transactional email (verification codes, account and security notices). Receives your email address and message content.
• PostHog — product analytics. Receives the anonymous/consented usage events described above.
• Convex, Coolify, Hostinger — application backend, deployment, and server infrastructure where your account, profile, works, and uploaded files are stored.

We do not sell your personal information. Each provider is contractually bound to protect your data and use it only to provide its service to us.

Data retention & deletion

We keep data only as long as it serves the purpose it was collected for:

• Account, profile & works: kept while your account is active, and deleted when you delete your account.
• Waitlist emails: kept until we invite you or you ask to be removed, whichever comes first.
• Analytics: retained according to PostHog's standard retention window.

You can, at any time:

• Delete your account and all associated data from your settings.
• Export your profile and works.
• Update or correct your profile, works, and account details.

On deletion, your data is removed from our active systems immediately. Backups may persist for up to 30 days before permanent deletion, and published works may remain cached in search engines temporarily.

Security

We employ industry-standard safeguards, including encrypted network connections (HTTPS), role-based internal access, and continuous monitoring. No online service can guarantee absolute security, but we work hard to protect your data and promptly address vulnerabilities.

Your rights (LGPD, GDPR & CCPA)

Under Brazil's LGPD — and, where applicable, the GDPR (EU/UK) and CCPA (California) — you have the right to:

• Confirm & access: know whether we process your data and get a copy.
• Rectify: correct inaccurate or incomplete information.
• Delete / anonymise: request erasure of your personal data ("right to be forgotten").
• Portability: receive your data in a machine-readable format.
• Object & restrict: object to or limit certain processing.
• Withdraw consent: where we rely on your consent (analytics), withdraw it at any time via "Cookie settings", with no effect on prior lawful processing.

Our lawful bases are: performing our contract with you (running your account and portfolio), your consent (analytics), and our legitimate interests (security and service improvement). To exercise any right, contact privacy@wordbound.app. You also have the right to lodge a complaint with Brazil's ANPD (or your local supervisory authority).

International data transfers

wordbound is operated from Brazil under the LGPD. Some of our providers (for example, PostHog) process data outside Brazil, including in the United States and the European Union. Where data is transferred internationally, we rely on appropriate safeguards and process it in accordance with the LGPD and the GDPR.

Children's privacy

wordbound is not intended for users under 13 years of age (or 16 in the EU). We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us immediately.

Contact us

For questions, data requests, or privacy concerns, contact the data controller, Flagrare Tech Sistemas LTDA.:

• Privacy & data requests: privacy@wordbound.app
• General support: support@wordbound.app